CVE-2022-49274

published 2025-02-26

CVE-2022-49274: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix crash when mount with quota enabled There is a reported crash when mounting…

Priority P4 18 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix crash when mount with quota enabled

There is a reported crash when mounting ocfs2 with quota enabled.

RIP: 0010:ocfs2_qinfo_lock_res_init+0x44/0x50 [ocfs2]
Call Trace:
ocfs2_local_read_info+0xb9/0x6f0 [ocfs2]
dquot_load_quota_sb+0x216/0x470
dquot_load_quota_inode+0x85/0x100
ocfs2_enable_quotas+0xa0/0x1c0 [ocfs2]
ocfs2_fill_super.cold+0xc8/0x1bf [ocfs2]
mount_bdev+0x185/0x1b0
legacy_get_tree+0x27/0x40
vfs_get_tree+0x25/0xb0
path_mount+0x465/0xac0
__x64_sys_mount+0x103/0x140

It is caused by when initializing dqi_gqlock, the corresponding dqi_type
and dqi_sb are not properly initialized.

This issue is introduced by commit 6c85c2c72819, which wants to avoid
accessing uninitialized variables in error cases. So make global quota
info properly initialized.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.17.3-1 (bookworm)	linux 5.17.3-1 (bookworm)
linux	linux	—	—
linux	linux	>= 6c85c2c728193d19d6a908ae9fb312d0325e65ca < 7c5312fdb1dcfdc1951b018669af88d5d6420b31	7c5312fdb1dcfdc1951b018669af88d5d6420b31
linux	linux	>= 6c85c2c728193d19d6a908ae9fb312d0325e65ca < 01931e1c4e3de5d777253acae64c0e8fd071a1dd	01931e1c4e3de5d777253acae64c0e8fd071a1dd
linux	linux	>= 6c85c2c728193d19d6a908ae9fb312d0325e65ca < eda31f77317647b9fbf889779ee1fb6907651865	eda31f77317647b9fbf889779ee1fb6907651865
linux	linux	>= 6c85c2c728193d19d6a908ae9fb312d0325e65ca < de19433423c7bedabbd4f9a25f7dbc62c5e78921	de19433423c7bedabbd4f9a25f7dbc62c5e78921
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 0 < 5.17.3-1	5.17.3-1
linux	linux_kernel	>= 5.15 < 5.15.33	5.15.33
linux	linux_kernel	>= 5.16 < 5.16.19	5.16.19
linux	linux_kernel	>= 5.17 < 5.17.2	5.17.2

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-908